Computers include general purpose central processing units (CPUs) that are designed to execute a specific set of system instructions. A group of processors that have similar architecture or design specifications may be considered to be members of the same processor family. Examples of current processor families include the Motorola 680X0 processor family, manufactured by Motorola, Inc. of Phoenix, Ariz.; the Intel 80X86 processor family, manufactured by Intel Corporation of Sunnyvale, Calif.; and the PowerPC processor family, which is manufactured by Motorola, Inc. and used in computers manufactured by Apple Computer, Inc. of Cupertino, Calif. Although a group of processors may be in the same family because of their similar architecture and design considerations, processors may vary widely within a family according to their clock speed and other performance parameters.
Each family of microprocessors executes instructions that are unique to the processor family. The collective set of instructions that a processor or family of processors can execute is known as the processor's instruction set. As an example, the instruction set used by the Intel 80X86 processor family is incompatible with the instruction set used by the PowerPC processor family. The Intel 80X86 instruction set is based on the Complex Instruction Set Computer (CISC) format. The Motorola PowerPC instruction set is based on the Reduced Instruction Set Computer (RISC) format. CISC processors use a large number of instructions, some of which can perform rather complicated functions, but which require generally many clock cycles to execute. RISC processors use a smaller number of available instructions to perform a simpler set of functions that are executed at a much higher rate.
The uniqueness of the processor family among computer systems also typically results in incompatibility among the other elements of hardware architecture of the computer systems. A computer system manufactured with a processor from the Intel 80X86 processor family will have a hardware architecture that is different from the hardware architecture of a computer system manufactured with a processor from the PowerPC processor family. Because of the uniqueness of the processor instruction set and a computer system's hardware architecture, application software programs are typically written to run on a particular computer system running a particular operating system.
Computer manufacturers want to maximize their market share by having more rather than fewer applications run on the microprocessor family associated with the computer manufacturers' product line. To expand the number of operating systems and application programs that can run on a computer system, a field of technology has developed in which a given computer having one type of CPU, called a host, will include an emulator program that allows the host computer to emulate the instructions of an unrelated type of CPU, called a guest. Thus, the host computer will execute an application that will cause one or more host instructions to be called in response to a given guest instruction. Thus the host computer can both run software designed for its own hardware architecture and software written for computers having an unrelated hardware architecture. As a more specific example, a computer system manufactured by Apple Computer, for example, may run operating systems and application programs written for PC-based computer systems. It may also be possible to use an emulator program to operate concurrently on a single CPU multiple (and possibly different or incompatible) operating systems. In this arrangement, although each operating system is distinct from the others, an emulator program can host one of the two operating systems, allowing the otherwise incompatible operating systems to run concurrently on the same computer system.
When a guest computer system is emulated on a host computer system, the guest computer system is said to be a virtual machine, as the guest computer system exists only as a software representation in the host operating system of the hardware architecture corresponding to the guest computer system. The terms emulator, virtual machine, and processor emulation are sometimes used interchangeably to denote the ability to mimic or emulate the hardware architecture of an entire computer system. As an example, the Microsoft Corporation's Virtual PC software emulates an entire computer that includes an Intel 80X86 Pentium processor and various motherboard components and cards. The operation of these components is emulated in the virtual machine that is being run on the host machine. An emulator program executing on the operating system software and hardware architecture of the host computer, such as a computer system having a PowerPC processor, mimics the operation of the entire guest computer system.
The emulator program acts as the interchange between the hardware architecture of the host machine and the instructions transmitted by the software running within the emulated environment. This emulator program may be a host operating system (HOS), which is an operating system running directly on the physical computer hardware. Alternately, the emulated environment might also be a virtual machine monitor (VMM) which is a software layer that runs directly above the hardware and which virtualizes all the resources of the machine by exposing interfaces that are the same as the hardware the VMM is virtualizing (which enables the VMM to go unnoticed by operating system layers running above it). A host operating system and a VMM may run side-by-side on the same physical hardware.
Data security is important for maintaining a secure computing environment. If access to the data in data files is not restricted and controlled, a myriad of threats to that data are possible—for example, the data content may be intercepted or modified. Examples of these harmful sources include, but are not limited to, viruses, other software applications, employees (disgruntled or otherwise), hackers, and operating system errors.
For example, several governmental agencies have computer systems that require a high level of security with respect to access to the contents of confidential data, but these agencies do not have the technical expertise required to design, implement, and support all aspects of their complex computer systems. On the other hand, there are several companies that design, implement, and support computer systems and their operating systems, but they cannot be granted unrestricted access to these agencies' computer systems because of the highly sensitive nature of the data content housed therein.
One solution is for the agencies to encrypt their data so that, when accessed by such companies, the data content is incomprehensible. Encryption is employed in computer systems to limit readability of data files to those who know how to decrypt it (have the correct encryption algorithm). However, most data encryption is “file-based”—that is, while the contents of the file are hidden, specific information about the file is still unencrypted, including the file name, header information, metadata, and file characteristics (such as size, location, etc.), and thus the files remain vulnerable. Microsoft Corporation's Encrypting File System (EFS) is an example of a prior art system for encrypting files (see white paper, “Encrypting File System for Windows 2000”, available on the Internet. What is needed is a way to improve data access security in computer systems to support high-security applications—specifically, sector-level data encryption. Also, there is an additional need for a means by which security can be added to a virtual machine without having to be written directly into the VM (or, more correctly, the VMM on behalf of the VM).